exploit errors reported

[togethernet]

Hi

I thought I would install and run the plug-in Wordpress Exploit Scanner (http://ocaoimh.ie/exploit-scanner/)

It throws a lot of errors from the s2Member plug-in with respect to use of the eval function.

Put my mind at rest?

[Cristián Lávaque]

eval has its valid uses. The WordPress team reviews plugins posted there and wouldn't have let s2Member remain there if it were a threat.

I'm emailing Jason in case he wants to comment on this.

[Jason Caldwell]

Thanks for the heads up on this thread.

Hi

I thought I would install and run the plug-in Wordpress Exploit Scanner (http://ocaoimh.ie/exploit-scanner/)

It throws a lot of errors from the s2Member plug-in with respect to use of the eval function.

Put my mind at rest?

I can appreciate your concern. Yes, eval() does have valid uses.

s2Member's use of the eval() function allows site owners, and ONLY site owners to incorporate PHP code of their own into some of s2Member's configuration panels. For instance, see: s2Member -> General Options -> Login/Registration Design -> Footer HTML/PHP Code.

SNAG-0107.png (13.38 KiB) Viewed 51 times

So, while the use of eval() CAN certainly introduce security issues, s2Member's use of eval() is limited to only those areas which process code introduced by the site owner, or by s2Member itself. s2Member will NOT eval() untrusted data ( i.e. data introduced by a user/browser/cookie/query string/etc ). I'm not aware of s2Member having any security issues in this regard, with respect to the eval() function.

---

On a Multisite Blog Farm installation, the use of eval() can be disabled completely, since you would have site owners with child Blogs on your Network. In cases such as those, the additional documentation that comes with a Multisite Network Support Package allows Network adminstrators to disable the use of eval() in areas of s2Member that allow site owners to introduce PHP code of their own.

That being said, I do NOT recommend disabling eval() in s2Member on a standard WordPress installation, or even on a typical Multisite Network installation. The only time that would be practical, is if you were running a "Blog Farm", where you would have untrusted site owners.

Definition of a Multisite Blog Farm:
If your Network is making it possible for "Members" of your Main Site, to create and/or manage Blogs (in any way), s2Member will consider your installation to be a Multisite Blog Farm. That being said, some site owners run a Multisite Network for the purpose of maintaining their own sites. The term Multisite Blog Farm does NOT apply to a Network that hosts multiple Child Blogs, all of which are operated by a single site owner and/or a single company. Again, a Multisite Blog Farm ( in the eyes of s2Member ), is any Network that is making it possible for "Members" of its Main Site, to create and/or manage Blogs; where one or more of these Child Blogs is being administered by a Customer ( e.g. if you offer both Membership and Blog creation ).